cis-aws-foundations-2-10

name	cis-aws-foundations-2.10
description	Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password
category	cis-iam
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","iam","mfa","console-password","authentication","users"]
cis_id	2.10
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-2.5","cis-aws-foundations-2.6"]
prerequisites	[]
severity_boost	{}

Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password

Description

Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they are prompted for their username and password as well as an authentication code from their physical or virtual MFA device. It is recommended that MFA be enabled for all IAM users that have a console password.

Rationale

Enabling MFA increases security for console access by requiring the authenticating principal to possess a device that generates a time-sensitive authentication code, in addition to their credentials.

Impact

Without MFA, IAM user accounts with console access are more susceptible to credential compromise, potentially leading to unauthorized access to AWS resources.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam.
2. In the left pane, select Users.
3. If the MFA or Password age columns are not visible, click the gear icon in the upper right corner and enable them.
4. Ensure that for each user where the Password age column shows a value, the MFA column shows Virtual, U2F Security Key, or Hardware.

Using AWS CLI

1. Run the following command:

aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,8

2. The output of this command will produce a table similar to the following:

user,password_enabled,mfa_active
elise,false,false
brandon,true,true
rakesh,false,false
helene,false,false
paras,true,true
anitha,false,false

3. For any column having password_enabled set to true, ensure mfa_active is also set to true.

Expected Result

All IAM users with password_enabled set to true also have mfa_active set to true.